export type ExternalKeyStoreConfig = {
    endpoint: string;
    tlsCertPath?: string;
    apiKey?: string;
    timeout: number;
};
export type ExternalKeyInfo = {
    keyId: string;
    location: string;
    lastAccessedAt: Date;
    accessCount: number;
};
/**
 * External key store integration (on-premises HSM support)
 * Phase 3: Integration with external HSM infrastructure
 */
export declare class ExternalKeyStoreProvider {
    private readonly config;
    private readonly keyCache;
    constructor(config: ExternalKeyStoreConfig);
    /**
     * Validate configuration
     */
    private validateConfig;
    /**
     * Connect to external key store
     */
    connect(): Promise<boolean>;
    /**
     * Check connectivity
     */
    healthCheck(): Promise<boolean>;
    /**
     * Retrieve key from external store
     */
    getExternalKey(keyId: string): Promise<Uint8Array>;
    /**
     * Store key in external store
     */
    storeExternalKey(keyId: string, _keyMaterial: Uint8Array): Promise<void>;
    /**
     * Delete key from external store
     */
    deleteExternalKey(keyId: string): Promise<void>;
    /**
     * List keys in external store
     */
    listExternalKeys(): Promise<ExternalKeyInfo[]>;
    /**
     * Perform encryption in external store
     */
    encryptWithExternalKey(keyId: string, _plaintext: Uint8Array): Promise<Uint8Array>;
    /**
     * Perform decryption in external store
     */
    decryptWithExternalKey(keyId: string, _ciphertext: Uint8Array): Promise<Uint8Array>;
    /**
     * Perform signing in external store
     */
    signWithExternalKey(keyId: string, _payload: Uint8Array): Promise<Uint8Array>;
    /**
     * Record key access for audit
     */
    private recordAccess;
    /**
     * Get key access statistics
     */
    getKeyStats(keyId: string): ExternalKeyInfo | undefined;
    /**
     * Get all access statistics
     */
    getAllStats(): ExternalKeyInfo[];
    /**
     * Verify BYOK (Bring Your Own Key) compliance
     */
    verifyBYOKCompliance(keyId: string): {
        isCompliant: boolean;
        reason: string;
    };
    /**
     * Disconnect from external key store
     */
    disconnect(): Promise<void>;
}
//# sourceMappingURL=external-kms.d.ts.map